Model Stealing Attack Method Based on Gradient Driven Data Generation

Abstract

The present invention relates to a model stealing attack method based on gradient-driven data generation, and belongs to the field of computer and information science and technology. The method first performs K-means clustering on a data set; then inputs a query data set consisting of cluster centroids into a target model through an API to obtain a label corresponding to each piece of data; then uses the data-label pair as a training set to train a substitute model; finally, constructs an objective function based on the output difference between the target model and the substitute model, and generates data based on the function gradient to iteratively train the substitute model. The present invention generates data based on the output difference gradient between models and steals the target model, which solves the problem of low accuracy of the substitute model caused by the unknown training set of the target model during the model stealing process, reduces the number of API calls to the target model, and improves the efficiency of model stealing.

Description

Technical Field

[0001] The invention relates to a model stealing attack method based on gradient-driven data generation, and belongs to the field of computer and information science and technology. Background Art

[0002] With the rapid development of machine learning, many fields such as image classification and malware identification have solved corresponding problems by building machine learning models. However, since machine learning models involve privacy-sensitive information of training data and the commercial value of actual applications, their security has always attracted much attention. In recent years, the emergence and development of model stealing technology has posed a direct challenge to the security of models.

[0003] The problem that model stealing needs to solve is: in the absence of prior knowledge of the target model (training data, model structure, model parameters, etc.), using the public access interface to perform black-box access to the model, and using the access data and returned labels and other information to construct a substitute model that is very similar to the target model, thereby destroying the confidentiality of the target model or launching further adversarial attacks. Comprehensive existing model stealing methods can generally be divided into two categories:

[0004] 1. Model stealing method based on equation solving

[0005] Since the processing process of some simple models (such as support vector machines, neural network algorithms, etc.) is to obtain output results by mapping input data through functions, it is easy to build a model similar to the target model by simply using the input data and output results to establish multiple sets of equations to solve the parameters of the function. However, as the structure of the model becomes more and more complex and the number of model parameters continues to increase, not only the amount of input query data needs to increase accordingly, but the amount of calculation to solve the equation will also increase exponentially.

[0006] 2. Model stealing method based on training alternative models

[0007] The unlabeled data is input into the target model through a public access interface to obtain the corresponding labels and other information. The training set consisting of the input and labels is used to train a substitute model with similar functions to the target model. However, the current method still requires information such as seed samples or data distribution of the original training data. When the original training data information is unknown, it is necessary to increase the number of data queries to improve the similarity between the substitute model and the target model.

[0008] In summary, although model stealing based on equation solving can restore accurate parameters, as the model complexity increases, the number of input data queries and the amount of calculation required to solve the equation will increase rapidly, so it is only applicable to models with few parameters and small scale. Model stealing attacks based on training substitution models require knowledge of the target deep neural network's training data or auxiliary data.

[0009] However, people are increasingly aware of data protection, and model training data in some sensitive fields are strictly protected, so attackers cannot obtain training data; in addition, existing methods require a large number of data queries to generate labels for data, and many models use methods that limit the number of accesses to model APIs to monitor and defend against model stealing attacks. Therefore, the present invention proposes a method for generating training data using the decision boundary information of the target model and the gradient information of the alternative model to improve the efficiency of model stealing. Summary of the invention

[0010] The purpose of the present invention is to solve the problem of low accuracy of the substitute model caused by the inability to obtain the training data set of the target model and the limited number of target model API calls during the model stealing process, and propose a model stealing attack method based on gradient-driven data generation.

[0011] The design principle of the present invention is as follows: the present invention first uses a clustering algorithm to cluster the training set; then the data of the cluster center is used as input, and is input into the target model through the API interface to obtain the label corresponding to each piece of data; then the replacement model is trained using the data with updated labels; finally, the difference between the target model and the replacement model is compared through the cross entropy loss function. If the loss is higher than the preset threshold, new data is generated based on the decision boundary information of the target model contained in the data with updated labels, and after being adjusted by the gradient information of the replacement model, it is input into the target model again and the subsequent process is repeated; if the loss is lower than the preset threshold, the replacement model at this time can be used as the final output. See the specific process for details. Figure 1 .

[0012] The technical solution of the present invention is achieved through the following steps:

[0013] Step 1: Divide the public dataset.

[0014] Step 1.1, divide the public dataset into training set and test set.

[0015] Step 2: Perform k-means clustering on the training set.

[0016] Step 2.1, initialize the number of clusters, randomly select a corresponding number of data points from the training set as centroids, and preset the clustering termination threshold.

[0017] Step 2.2, for each data point in the training set, calculate its Euclidean distance to each centroid and divide it into the set to which the nearest centroid belongs.

[0018] Step 2.3, after all data are divided, recalculate the centroid of each set.

[0019] Step 2.4: If the distance between the new centroid and the original centroid is greater than the preset threshold, repeat steps 2.2 and 2.3; otherwise, terminate clustering and obtain a data set consisting of the new centroid as the query data set.

[0020] Step 3: Use the target model to label the query dataset and train the alternative model.

[0021] Step 3.1: Input the query data set into the target model, obtain the label corresponding to each data, and form a data-label pair.

[0022] In step 3.2, a surrogate model is trained using the augmented dataset with data-label pairs.

[0023] Step 4: Use the cross entropy loss function to compare the difference between the alternative model and the target model.

[0024] In step 4.1, the test set is input into the target model and the alternative model respectively, and the cross entropy loss is calculated for the output results.

[0025] In step 4.2, the cross entropy loss is compared with the preset threshold. If the cross entropy loss is greater than the threshold, step 5 is performed. Otherwise, an alternative model that meets the expectations is output.

[0026] Step 5: query data generation and data distillation.

[0027] Step 5.1, calculate the Euclidean distance between the data in the data sets obtained in steps 3.1 and 3.2.

[0028] In step 5.2, the decision boundary information of the target model contained in the data with different class labels is used to generate new data between each data and the nearest data of different categories.

[0029] In step 5.3, the generated data is used as the initial distillation data, and the distillation model is initialized with the alternative model structure and parameters obtained in step 3.2.

[0030] Step 5.4, update the distillation model parameters using the distillation data.

[0031] In step 5.5, data is extracted from the test set and input into the substitution model and the distillation model respectively, and the output difference of the two models is used as the loss function.

[0032] Step 5.6, update the distillation data according to the loss function and gradient descent formula.

[0033] Step 5.7, repeat steps 5.4-5.6 according to the preset number of times to obtain the distilled data.

[0034] Step 5.8: Use the distilled dataset as a new query dataset and repeat steps 3 and 4.

[0035] Beneficial Effects

[0036] Compared with the existing model stealing methods, the present invention introduces new data generation rules and makes full use of the decision boundary information of the target model to generate a data set to train the substitute model, thereby improving the similarity between the decision boundary of the substitute model and the target model; by using the parameters of the substitute model in the data distillation method to guide the distillation of the data set, a loss function that maximizes the difference between the target model and the substitute model is constructed, so that the distilled data can speed up the training process of the substitute model, while reducing the number of API calls and improving the efficiency of model stealing. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a schematic diagram of the model stealing attack method based on gradient-driven data generation of the present invention. DETAILED DESCRIPTION

[0038] In order to better illustrate the purpose and advantages of the present invention, the implementation of the method of the present invention is further described in detail below with reference to the accompanying drawings and examples.

[0039] The specific process is:

[0040] Step 1: Divide the public dataset.

[0041] Step 1.1: Divide the public dataset into training set T and training set T according to the ratio of 4:1. train With the test set T test .

[0042] Step 2: Perform k-means clustering on the training set.

[0043] Step 2.1, initialize the number of clusters k, from the training set T train ={t1,t2,…,t N} randomly select k data as the initial centroid, denoted as {c1,c2,…,c k}, preset clustering termination threshold μ.

[0044] Step 2.2, calculate data t i (i=1,2,…,N) and each centroid c j The Euclidean distance f of (j=1,2,…k) i,j , the distance calculation formula is t i Divide into the set to which the nearest centroid belongs, and obtain k clusters (C1, C2, ..., C k ).

[0045] Step 2.3, using each C i Recalculate the centroid with the data contained in

[0046] Step 2.4, if c′ i and c i The distance between them is greater than the threshold μ, then c′ i If the centroid is the same, repeat steps 2.2 and 2.3. Otherwise, clustering is terminated and the data set {c′1, c′2, …, c′ k}, and use it as the query data set, denoted as where x i =c′ i .

[0047] Step 3: Use the target model to label the query dataset and train the alternative model.

[0048] Step 3.1: Input the query data set X into the target model to obtain each data x i Label y i , forming data-label pairs

[0049] Step 3.2, use Expanding the dataset Then train the replacement model to obtain model M.

[0050] Step 4: Use the cross entropy loss function to compare the difference between the alternative model and the target model.

[0051] Step 4.1: Set the test set T test Input them into the target model and the alternative model respectively, and record the output of the target model as the true label y j , the output probability of the alternative model is recorded as P j , calculate the cross entropy loss

[0052] In step 4.2, the cross entropy loss E is compared with the preset threshold Th. If it is greater than the threshold, proceed to step 5. Otherwise, the expected replacement model is output.

[0053] Step 5: Data generation and data distillation.

[0054] Step 5.1, calculate With X train The Euclidean distance between two data in .

[0055] Step 5.2: Using the target model decision boundary information contained in the different class label data, i The most recent non-same category data x j Generate new data x′ i , the generating formula is x′ i =αx i +(1-α)xj ,in x j ∈X train , α represents the interpolation coefficient, which ranges from α∈(0.5,1) and is used to control the newly generated data x′ i Closer to x i or x j ; x′ i The label is inherited from x i , x i With x j The distance between i The resulting data set

[0056] In step 5.3, X′ is used as the initial distillation data, and the distillation model is initialized with the structure and parameters of the model M. The parameters of the distillation model M′ are denoted as θ0.

[0057] Step 5.4, using the formula Update the distillation model parameters, where l(x′ i ,θ0) represents the data set x′ i The loss on the model with parameters θ0, and η is the learning rate.

[0058] Step 5.5, from the test set T test Randomly extract the data set Input into the substitution model M and distillation model M′ respectively, and get the output y=f M (T m ,θ0) and y′=f M′ (T m ,θ1), where f M (T m ,θ0) represents the data set T m The output obtained after inputting into the model M with parameter θ0. Then calculate the loss function L, formula Where y and y′ represent the outputs of the substitution model and the distillation model respectively, and k represents the dataset T m The total number of samples in .

[0059] Step 5.6, according to the formula Update distillation data where d i Corresponding to step 5.2, it means querying the data set x i The most recent non-same category data x j The Euclidean distance between i represents the generated distillation data, Represents the loss function L for generating data x′ iThe gradient of , X′ represents the new dataset containing k samples generated after distillation.

[0060] Step 5.7, repeat steps 5.4-5.6 according to a preset number of times to obtain the distilled data X′.

[0061] Step 5.8: Use the distilled dataset X′ as the query dataset and repeat steps 3 and 4.

[0062] As described above, the present invention can be better implemented.

[0063] The specific description above further illustrates the purpose, technical solutions and beneficial effects of the invention in detail. It should be understood that the above is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. Model stealing attack method based on gradient-driven data generation, characterized by The method comprises the following steps: Step 1: Perform k-means clustering on the public data set. After initializing the number of clusters and the centroid, use the distance between each data and the centroid to divide the set. Recalculate the centroid of the set and iterate to obtain the final cluster, and then obtain the centroid of each cluster to form the query data set. Step 2: Use the target model to label the data. Input the data in the query data set into the target model to obtain the label corresponding to each piece of data. Use the data set consisting of data-label pairs to train the alternative model. Step 3: Use the cross entropy loss function to compare the difference between the surrogate model and the target model. Input the same samples into the target model and the surrogate model respectively. Calculate the cross entropy loss based on the outputs of the target model and the surrogate model. Determine whether to continue generating query data and training the surrogate model based on the size of the cross entropy loss. Step 4: Generate new data between each data in this round of training set and the nearest non-similar data, and use it as the initial distillation data. Use the output difference between the substitution model and the distillation model to perform data distillation. Use the final distilled data as the next query data, and repeat the label query and substitution model training process.

2. The model stealing attack method based on gradient driven data generation according to claim 1, characterized in that: In step 4, the method for generating the data set X′ is to i The most recent non-same category data x j Generate new data x′ i , the generating formula is x′ i =αx i +(1-α)x j ,in x j ∈X train , α represents the interpolation coefficient, which ranges from α∈(0.5,1) and is used to control the newly generated data x′ i Closer to x i or x j .

3. The model stealing attack method based on gradient driven data generation according to claim 1, characterized in that: In step 4, the parameters θ0 of the surrogate model are used to replace the model parameters randomly initialized during the data distillation process, and the loss function is calculated using the output difference between the surrogate model and the distillation model. The formula is: Where y and y′ represent the outputs of the substitution model and the distillation model respectively, k represents the total number of samples used to calculate the loss, and the formula is used Update distillation data where x′ i represents the generated distillation data, Represents the loss function L for generating data x′ i The gradient of i Indicates querying data x in the dataset i The most recent non-same category data x j X′ represents the new dataset containing k samples generated after distillation.

Images